BPFDoor

index=linux_index sourcetype=linux:audit (type=SYSCALL AND (((SYSCALL=socket AND a0=17 AND a1=3) OR (SYSCALL=setsockopt AND a1=1 AND a2=26)) AND (exe="/dev/shm/kdmtmpflush" OR comm=“kdmtmpflush”))) OR (type=CWD AND (cwd="/var/run/haldrund.pid" OR cwd="/dev/shm/kdmtmpflush"))
| eval attackIndicators=mvappend(command,cwd)
| rename pid as processID ppid as parentProcessID
| table _time host SYSCALL attackIndicators processID parentProcessID action